Probably by using ALOT oof pointer scans. Only way I can think of.
Which dynamic addresses you talking about, I have noticed some take data from a different address so pointers may not be needed just the correct address. for example I was trying to do the health address for MP and thought I found the address and used the standard player offset o 0x38EC only to find the actual address was further back in the memory region with a player offset of 0x274